Posts by Doctor Syntax

Old, complex code could cause another UK banking TITSUP – study

Re: "Even if something has been written in Java in 90s that is still 20 years ago."

"Does - your - sourcecode - loose it's comments on the bedpost overnightttt?"

Brilliant.

Re: "Even if something has been written in Java in 90s that is still 20 years ago."

"that makes the software out of date"

No, it makes it require maintenance. Development is the process by which software is launched into maintenance. It usually spends most of its life there so it's no excuse for assigning the least competent staff to the job. Neither is it an excuse for relying on maintenance to do all the bug-fixing that should have been done during development (did someone say continuous release?) so documentation and testing are equally important in both phases.

Re: "...a 10-15 per cent charge on that project..."

'Traditionally, the "last 10%" (suc) (sic) of the code requires the other 200% of the budget.'

Re: Distant memories

"all the exception routines which made up over 90% of the average programme and were probably never used in production."

Like all safety devices, you hope they're never needed but when they are they're really needed.

"So sheer volume is no real measure of how good or reliable the code is. Although the more lines of code there are the higher the odds of an undetected flaw."

You're arguing against yourself here. All those exception handlers are there so that you can detect flaws. It's lot's of lines that don't do checking that are the problem.

"Exactly what purpose that was, and whether the code path might be required for some random future transaction is not always something that is clear."

It should be if the code was properly documented and the best place to do that is in the code itself, not in some separate document that's either been lost or never updated since day one.

"I am a coder, its the quality of the code not the length, if its there then it has purpose"

And very often that purpose is to deal with Stuff That Should Never Happen when it happens. The more you've got of that the better.

"However, in the UK mission-critical banking apps have between 800,000-900,000 lines of code."

So that's the apps. What about the application programs?

UK's Universal Credit IT may go downhill soon, warns think tank report

"Universal Credit IT may go downhill soon"

Soon?

"Making a success of Universal Credit"

Definitely a Sir Humphrey job.

Venezuela tops world lightning conductor league

Maybe they could sell this as a tourist attraction. They need the foreign currency as apparently they can't pay to have enough of their own printed to keep up with inflation. Where's Tim Worstall when you need him?

Do you know where your trade secrets are?

"Information security has always been a matter of corporate survival."

It needs to be a requirement written into company law as part of the director's responsibilities so that our A/C Information Security Officer could remind his board about the possibility of their becoming HM's guests, and not at a garden party.

Re: Extend this idea of restricting write privileges

@Paul

You need to think outside current models. Here's one.

One admin user has the power to allocate blocks of storage for a specific application. It can neither read nor write to those blocks, just allocate them. The user has to log on specifically as that user to do that - no privilege escalation is allowed.

The specific application does nothing but provide access to specific clients. It has complete and exclusive control of the blocks allocated to it. Once a block is allocated no other application can read or write to that block; there is no super-user which can also do that, not file system which kernel routines handle. The application enforces access writes based on a combination of both client application and user. The server application starts on boot-up or has to be restarted by a specific log on - no escalation of privilege is allowed.

Write access can be tied down completely - the server can be configured at source to only accept requests from specific applications. If the server isn't so configured then control is devolved to a specific admin user who can grant write access to specific clients. This admin can also specify applications from which read requests are handled and can optionally grant this right to specific users. The admin user has to log in specifically, no escalation of privilege is allowed.

Software installs and updates are handled by a specific user ID which checks signatures of install/update files. The user has to log in specifically to do this, no privilege escalation is allowed.

Granting user credentials? You guessed it. A specific admin ID to be logged in, no privileged escallation allowed.

So Cryptolocker can neither read nor write your office files directly. It probably can't have read requests accepted and it certainly can't have write requests accepted. It can't escalate its privilege to reallocate the office storage space to itself nor can it escalate its privileges to install itself as the server for that space nor even escalate its privilege to allow itself access, even if the server accepted such grants of write access, all these actions require a specific login, each with their own credentials. On a privately owned machine the user may have the credentials for all these admin IDs but in a business environment this is unlikely. This would make it significantly more difficult to persuade a owner/user to compromise their own machine and in the case of properly administered business networks it would require the collusion of one of the admin team.

You say Windows can have compartmentalisation of admin rights. But can it have compartmentalisation of access to hardware resources?

It makes admin less convenient but in part we are currently victims of a trend to make admin more convenient at the cost of reducing security. That isn't a good trend.

Re: @Doctor Syntax

"Windows has much of this built in and has done for a long time."

So if, for instance, I installed MS Office on a Windows PC I could configure it so that only Word can write to Word documents and only Excel could write to spreadsheets and that either format could be read to email them but neither could be read to copy to a USB drive?

"The board demands reports on 'cyber security' then complains they can't understand it then refuse all attempts to provide awareness training to them. They read reports then complain that it mentioned 'risks' and 'vulnerabilities'. I had to change them all to 'opportunities for improvement'."

Maybe the problem is in the presentation. Use language they can understand so the report becomes its ow awareness training. Introduce information security, risks and vulnerabilities by stating that they have to be accepted as such, euphemisms won't make them go away and they have to be dealt with which you're sure your board is capable of doing although lesser directors might shy away. And if that doesn't work, get your CV out there.

"Whatever is backing up your network has to have access to your network to do so, but you cannot have write privileges from the network side."

This is still a sticking-plaster remedy although it's the only one available to the user community.

We really need systems designed from the ground-up with an assumption of distrust built in. Our existing OSs originated when devices were much less threatened: users were trusted to a reasonable degree, devices may have single user and maybe not even networked, certainly not as open as the internet has made them. It's not the 1970s any more but responses to a deteriorating situation have been bolted onto less than secure systems.

Extend this idea of restricting write privileges beyond just the backup. Arrange things so that specific categories of information can only be written by a specific process. Write requests are only granted on the basis of not only the user but also the application that requests the write. Cryptolocker and the like wouldn't be on the approved list. Read requests would be similarly restricted although a wider list of applications might be approved - your print application needs to read the file it's printing and your email application needs to read the file it's sending. There should be no over-ruling this so a super-user in the Unix mould is out of the question.

Barclays.net Bank Holiday outage leaves firms unable to process payments

"Total number of customers or total number that tried to login?"

The total number who talk to each other at one time.

MongoDB on breaches: Software is secure, but some users are idiots

If these are being used for BI then we know the users don't understand security as well as not understanding statistics - http://www.theregister.co.uk/2016/05/02/stats_the_problem_with_bi/ .

Ultra-cool dwarf throws planetary party

Ultra-cool. Just the destination for a C ark with all the hipsters on it.

Microsoft wants devs to take notes on their families

Re: Local or remote processing?

'or does it bundle all the data off to every Tom, Dick and Harry for "processing"?'

Or just to a dick?

The EU wants you to log into YouTube using your state-issued ID card

Re: No ID cards in the UK? Tried to get a job recently, or rent property?

"Unless you happen to have your full, original, birth certificate"

The birth certificate remains with the Registrar General. All you have is a certified copy which does not prove identity.

Re: Brexit?

"So you're giving up on making the UK democracy work and hoping someone else will over-rule our democracy."

A strong court system is the best counter to government over-reach.

Both major parties have been quite keen on surveillance. Had the other David got the leadership of the Tories it might have been different but they went for a Blair-alike. The opportunity of voting a non-surveillance party into government under current circumstances is pretty-well non-existent so until that changes we need the court's protection.

Re: Brexit?

"But it's exactly things like this id card nonsense that drive people to want to get out of Europe."

You think the alternative wouldn't lead to worse? As things stand the European courts can slap down UK surveillance attempts and if we go through the legislate/slap down/legislate cycle enough times even governments might start to get embarrassed.

"Faecebook have been demanding ID such as passports and driving license / ID cards."

Do they?

I wouldn't know & don't care. If you imagine you need it then you I wouldn't be surprised if you fall for that sort of stuff.

Intel loses its ARM wrestling match, kicks out Atom mobe chips

"so investors insist on more frequent reports or they'll sell out."

That doesn't seem to be the Warren Buffet approach to investing & he's not done too badly.

Re: @ Doctor Syntax

I just checked. You were one of those commentators.

Re: @ Doctor Syntax

This is a story about Intel. The story you were looking for is over there. ------>

"someone somewhere in Whitehall is working on a plan that will screw with it"

I thought developing something to the point where it was nearly production ready and then canning it without reaping the rewards because it had cost too much already was a British disease. But no, here's Intel doing it It may well be that they couldn't see production bringing in enough returns to justify the money they've spent on development but then zero returns doesn't do it either.

I suppose the reason is that they've got to cut employee numbers RIGHT NOW to meet unrealistic analysts' expectations. Analysts, of course, don't realise or care that it's the employees who create the returns in the long run. So we'll see yet another tech company hollowed out due to short-termism.

The best thing that financial regulation could do would be to forbid the publication of quarterly results, maybe even the publication of results at less than two year intervals, just to get these idiots from breathing down managements' necks.

Chap runs Windows 95 on Apple Watch

Running slow. Not what you want in a watch.

Re: "This inquiring mind sort of thing has resulted in a good few discoveries ..."

"I've often wondered why the guy leapt out of that bath like that......"

He discovered the piranha.

Engineer uses binary on voting bumpf to flag up Cali election flaws

"What's an e-voting candidate? Well, according to Hanania's vision, it is one that directly follows the wishes of his or her constituents through online votes, regardless of his or her personal views."

Translated to UK terms: government by Daily Mail.

US data suggests Windows 10 adoption in business is slowing

Re: Have an upvote.

"So, KDE for Openbsd, or some other alternate dbus?"

I'm not sure if this is a rhetorical question or a genuine query. Assuming it's the latter, I haven't tried OpenBSD but KDE is available for FreeBSD and works just fine.

Re: Same old, same old

"come on El-Reg, what are the stats for the data for connections to your 'esteemed' site?"

Given that the connections are via a CDN would the client ID actually be available or would Cloudflare have hidden it?

Re: did Microsoft kill it's cash cow?

"e.g. the equivalent of persistently assigning a drive letter to a NAS share"

Maybe other desktops are different but with KDE it's a very similar process to Windows - open Dolphin, the file manager, click on Network, click on Add Network Folder & follow the prompts. This works for Samba/Windows connections - I don't have NFS client installed so I don't know whether that's supported.

Re: I wonder...

"What could the "other" category be ?"

Android?

Re: Have an upvote.

"Ubuntu ... I feel very constrained by what it will let me do on the desktop."

If you're on Unity try installing XFCE,LXDE, Mate, Cinnamon or KDE. I really dislike the notion that a desktop should only have icons for "apps" on it.

My preference is KDE set to folder view with a Desktop directory as the folder, Classic menu, the irritating bouncing cursor turned off along with auto-maximisation of windows. This ends up with an interface which is very similar to pre-insanity Windows from W95 onwards.

Who you callin' stoopid? No excuses for biz intelligence's poor stats

Re: Pearls to swine!

"house being built from roof down"

This is very successful as it means the builders can do the rest of the work in the dry.

'The “average” user may well not understand statistics but that surely puts the responsibility onto the designer of the BI package to do the appropriate stats'

No, if the "average"* user doesn't understand statistics they shouldn't be trying to use them. Business Intelligence - yet another oxymoron.

*"Hacker was a very average minister"

F-35s failed 'scramble test' because of buggy software

Re: five nines...

I think they're still working on one

FTFY

If the Internet of Things will be SOOO BIG why did Broadcom just quit the market?

Peak IoT in sight? If so the next hype product is needed PDQ. And no, not DevOps.

Miguel de Icaza on his journey from open source to Microsoft: 'It's a different company'

Re: Very disingenuous retrospective rehash of the historical record.

"What Killed the Linux Desktop"

Interesting read. So he finally realised that breaking compatibility on a regular basis wasn't a good idea. I could have told him that at the start. Experience is a dear teacher but there are those who will learn by no other.

Re: Miguel de Icaza is a great coder, and will always be so

Gentlemen. Please.

Try to understand the difference between libel and slander.

Re: open source people universally hate Miguel.

"I think Java single-handedly destroyed thousands of good middle-class American jobs by allowing mass import of H-1B numpties"

It's not a story I've followed but I'd have thought that the problem would be the system by which H1-B numbers are controlled (sic) rather than the specific language used in the projects for which the visas were issued. The generic problem isn't unknown on this side of the Atlantic either.

Linux greybeards release beta of systemd-free Debian fork

Re: Perhaps you were downvoted

"But that is the opposite of the truth. Ubuntu (as represented by Ian Jackson) wanted Debian to use upstart."

And the systemd promoters couldn't allow that to happen. Not that a choice between systemd and upstart is one I'd want.

"The alternative would have been to say bye-bye to bluetooth in Slackware"

Pulseaudio incorporated Bluetooth?

Re: Init freedom

"In short, some people didn't like a new feature so they used the free software to make a version they were comfortable with. This is perfect, however much you do or don't give a shite about systemd, you have to love that people have the tools to do what they want."

My concern is that although they've been able to achieve this now there'll be a time when so much of the GNU/Linux userland assumes systemd is there that it becomes impracticable to build a distro without it.

My other concern is that the whole approach of the systemd/opendesktop people is to gradually convert what was a Unix-like OS into one which won't be. So those of us who used Linux because of what it was will be looking elsewhere.

Windows 10 handcuffs Cortana web search to Bing and Edge browser

"Microsoft has taken the attitude that it is better to apologize than ask for permission."

Have they ever apologised?

Switch survives three hours of beer spray, fails after twelve

Re: A few splashes?

"Was the VAX still running?"

Several floors up in Eversholt street. The water never got that high ;)

Re: A few splashes?

"Turned out that a 6bar mains head had sheared off in the basement"

Once upon a time a main ruptured in Melton St alongside the forecourt to Euston Station. It washed a huge crater in the road and got into the underground car park. Reportedly cars were floating.

We had a VAX admin on his way in by tube to start an afternoon shift. He said that the train stopped. The power went off. Then the water started coming up through the floor.

Re: Sadly not beer

"How does one even get cooked spaghetti into a slot-loading drive?"

For a bet?

US govt quietly tweaks rules to let cops, Feds hack computers anywhere, anytime

Re: One Possible Solution

"All Senator Ron Wyden has to point out is that with this simple change, law enforcement officials could easily be hacking into THEIR computers and perhaps dig up some dirty secrets."

Is that really the case? AIUI it obviates the need to know where the target is located when applying for a warrant. If that's the only change then providing that they know where the target is located then they could apply for the warrant they could hack into it under the existing rules.

Carl Icahn: Will someone rid my portfolio of this rotten Apple?

'Icahn said he would buy Apple stock again if China "was basically steadied,"'

I suppose that for a moment they thought they'd got rid of him.